Hi Team,
Need your help. We have a data as below. Now we have a field have message. From that EFFDATE,MEMID and MID has been derived. Now customer wants a drilldown. In statistics table if he do a mouse over on any of the fields EFFDATE,MEMID and MID the entire value in "message" field should be listed. It is like a mouseover in Column chart, Attached below. Please help me the logic. CSS/Script/Tokens. Expecting your help on this.
| makeresults count=3
| eval message="Message"+" "+"14"+" "+"DUPLICATE"+" "+"MID"+"Mid"+":"+"103557"+"'"+"memId"+":"+"98"+"'"+"Eff Date"+":"+"Wed Nov 06 00:00:00 CST 2019"
|rex field="message" "(.*)(?<MID>\d\d\d\d\d\d)(.*)"
|rex field="message" "(.*)(?<MEMID>\d\d)(.*)"
|rex field="message" (.*(?<EFFDATE>\D\D\D\s\D\D\D\s\d\d\s\d\d:\d\d:\d\d\s\D\D\D\s\d\d\d\d))
| fields - _time
EFFDATE MEMID MID message
Wed Nov 06 00:00:00 CST 2019 19 103557 Message 14 DUPLICATE MIDMid:103557'memId:98'Eff Date:Wed Nov 06 00:00:00 CST 2019
Wed Nov 06 00:00:00 CST 2019 19 103557 Message 14 DUPLICATE MIDMid:103557'memId:98'Eff Date:Wed Nov 06][1]
... View more